CVE-2026-9998 is an integer overflow vulnerability in the Skia graphics library used by Google Chrome before version 148.0.7778.216. The flaw permits a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could enable the attacker to break out of the restricted execution environment of the renderer process, increasing the risk of further system compromise. The vulnerability was publicly disclosed on May 28, 2026, with a vendor advisory linked to a Chrome stable channel update blog post. No CVSS score or explicit remediation level is provided in the available data.

If exploited, this vulnerability could allow an attacker with control over the renderer process to escape the sandbox protections of Google Chrome. This could lead to execution of code with higher privileges than normally permitted within the browser context, increasing the potential impact of an initial compromise. However, there are no known exploits in the wild currently reported.

Google has released an update to Chrome version 148.0.7778.216 that addresses this vulnerability. Users should update to this version or later to mitigate the risk. Since this is a client-side application, patching the browser is the recommended and effective mitigation. Patch status is not explicitly confirmed in the advisory content provided, so users should verify the update availability and installation via the official Chrome release blog and update mechanisms.